StarMirror
/
sandboxed-api
mirror of https://github.com/google/sandboxed-api
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

drop almost all capabilities during sandbox creation 

PiperOrigin-RevId: 578096197
Change-Id: I900cfab378f0069e8daac60b5eb41c5eb7401692
pull/171/head
Sandboxed API Team 2023-10-31 01:31:00 -07:00 committed by Copybara-Service
parent 4630346fd1
commit 79ab44c981
1 changed files with 24 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
sandboxed_api/sandbox2/forkserver.cc
View File

@ -536,6 +536,30 @@ pid_t ForkServer::ServeRequest() {
bool ForkServer::IsTerminated() const { return comms_->IsTerminated(); }
bool ForkServer::Initialize() {
// For safety drop as many capabilities as possible.
// Note that cap_t is actually a pointer.
cap_t have_caps = cap_get_proc(); // caps we currently have
SAPI_RAW_CHECK(have_caps, "failed to cap_get_proc()");
cap_t wanted_caps = cap_init(); // starts as empty set, ie. no caps
SAPI_RAW_CHECK(wanted_caps, "failed to cap_init()");
for (cap_flag_t flag : {CAP_EFFECTIVE, CAP_PERMITTED}) {
cap_flag_value_t value;
int rc = cap_get_flag(have_caps, CAP_SETFCAP, flag, &value);
SAPI_RAW_CHECK(!rc, "cap_get_flag");
if (value == CAP_SET) {
cap_value_t caps_to_set[1] = {
CAP_SETFCAP,
};
rc = cap_set_flag(wanted_caps, flag, 1, caps_to_set, CAP_SET);
SAPI_RAW_CHECK(!rc, "cap_set_flag");
}
}
SAPI_RAW_CHECK(!cap_set_proc(wanted_caps), "while dropping capabilities");
SAPI_RAW_CHECK(!cap_free(wanted_caps), "while freeing wanted_caps");
SAPI_RAW_CHECK(!cap_free(have_caps), "while freeing have_caps");
// All processes spawned by the fork'd/execute'd process will see this process
// as /sbin/init. Therefore it will receive (and ignore) their final status
// (see the next comment as well). PR_SET_CHILD_SUBREAPER is available since